pq/scripts
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

basement install.sh: preserve admin user + password hash across re-runs

Browse Source 
Re-running install.sh was wiping BASEMENT_ADMIN_USER and _PASSWORD_HASH
back to empty in my-basement.xml — the user then had to re-enter them
in the Unraid UI every time. Annoying.

Template now declares those two fields as __PLACEHOLDER__ tokens.
install.sh, before fetching the new template, sed-extracts whatever's
currently in the existing my-basement.xml and feeds those values back
into the substitution. First-time installs sub to empty (user fills
via UI); subsequent runs preserve what's there.

Bcrypt's $-heavy chars survive sed because `|` is the delimiter and
sed only interprets $ in regex/match, not replacement.
This commit is contained in:
matthew
2026-05-19 08:35:11 -07:00
parent e9464bb3c5
commit 574376aa75
2 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
unraid-1/basement.template.xml
+2 -2
View File
@@ -55,7 +55,7 @@ Publicly served at https://basement.pq.io via Caddy on classe (reverse proxy →
<Config Name="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Target="BASEMENT_DRIVER_GARAGE_ADMIN_TOKEN" Default="" Mode="" Description="Bearer token for Garage admin API. Pre-filled by install.sh (same value as the garage container's GARAGE_ADMIN_TOKEN)." Type="Variable" Display="always" Required="true" Mask="true">__GARAGE_ADMIN_TOKEN__</Config>
<Config Name="BASEMENT_DRIVER" Target="BASEMENT_DRIVER" Default="garage" Mode="" Description="Storage backend driver. 'garage' for this deployment." Type="Variable" Display="always" Required="true" Mask="false">garage</Config>
<Config Name="BASEMENT_ADMIN_USER" Target="BASEMENT_ADMIN_USER" Default="" Mode="" Description="Login username for the basement UI. Pick something; you'll log in with this + the password whose hash goes below." Type="Variable" Display="always" Required="true" Mask="false"/>
<Config Name="BASEMENT_ADMIN_PASSWORD_HASH" Target="BASEMENT_ADMIN_PASSWORD_HASH" Default="" Mode="" Description="Bcrypt hash of the admin password ($2a$/$2b$ format). Generate with: htpasswd -bnBC 12 '' yourpassword | tr -d ':\n'" Type="Variable" Display="always" Required="true" Mask="true"/>
<Config Name="BASEMENT_ADMIN_USER" Target="BASEMENT_ADMIN_USER" Default="" Mode="" Description="Login username for the basement UI. Pick something; you'll log in with this + the password whose hash goes below. install.sh preserves whatever you set here across re-runs." Type="Variable" Display="always" Required="true" Mask="false">__BASEMENT_ADMIN_USER__</Config>
<Config Name="BASEMENT_ADMIN_PASSWORD_HASH" Target="BASEMENT_ADMIN_PASSWORD_HASH" Default="" Mode="" Description="Bcrypt hash of the admin password ($2a$/$2b$ format). Generate with: docker run --rm caddy:alpine caddy hash-password --plaintext 'yourpassword'. install.sh preserves whatever you set here across re-runs." Type="Variable" Display="always" Required="true" Mask="true">__BASEMENT_ADMIN_PASSWORD_HASH__</Config>
<Config Name="BASEMENT_JWT_SECRET" Target="BASEMENT_JWT_SECRET" Default="" Mode="" Description="HMAC secret for signing UI session JWTs. Pre-filled by install.sh from secrets.env (auto-generated, persisted across re-runs)." Type="Variable" Display="always" Required="true" Mask="true">__BASEMENT_JWT_SECRET__</Config>
</Container>